A corps that runs itself.
The plan: makers who build privacy witnesses for people who can't, neighbors who ask, paired slowly and personally — and a community that holds no data and runs no backend. Here's how it's meant to work. None of it is finished; this page never pretends otherwise.
Two sides, and the gallery between them
Everyone enters where they fit. Each door is live today as a way to raise your hand; the machinery that connects them is what's still being built.
Makers
Handy with a printer and an iron? Get certified in stages and build for people who can't build their own.
Are you a maker? →Requesters
Can't build it yourself? Post what you need and be paired with a maker who chooses to make it — no race, no cost.
Have one made →The gallery
Built one already? Share your shell, your color, your remix — and make the next person's build easier.
Show your build →It holds no data and runs no backend
A privacy company shouldn't run a honeypot of its users. So the corps is built the same way the camera is: public things live in the open; private things never leave your device. There is nothing in the middle to breach.
GitHub is the “backend”
Build stories, enclosure remixes, and the maker roster are files, issues, and pull requests in the public repo. The site just renders committed content (the way the Lab reads registry.json). You contribute by opening a pre-filled issue — versioned, reviewable, remixable, and run by no server we own.
Your situation never leaves
A request's sensitive story stays in your browser (localStorage) — we never receive it, so we can never leak it or be compelled to hand it over. When pairing opens, you'll reveal it end-to-end to one maker you choose, and nowhere else.
Earned in stages, not bought
Apprentice
Build a Canary end-to-end in the browser. Costs nothing; start today.
Builder
Build one real unit — verified by the device's own signed self-test.
Certified Maker
Build & install for someone else, past a safety & consent checklist.
Steward
Train others and host local build days. The corps' face in each town.
A market that accounts for itself
The long game: no human referee at all.
in design
Because a Canary cryptographically attests its own genuine build and health, the deliverable can prove it was delivered — so the market can settle on a device's signed “birth certificate” instead of an escrow agent, with reputation as a living fleet of attesting hardware, funds as neighborly reimbursement, and only human conduct left for a small steward quorum. It's the witness kernel, pointed at people. Written up as a draft RFC; nothing here ships yet.
Everything above is a plan, honestly labeled. The doors are open for raising your hand; the connective machinery is coming. In the spirit of the product, a concept never pretends to ship.